Credit Card Processing and EMV FAQ


What is this credit card “liability shift” I keep hearing about?

The basic meaning is that, since credit cards with chips are the new Payment Card Industry [PCI] standard, if you, as a merchant, accept a card that turns out to be counterfeit but you didn’t know it was because your store doesn’t have credit card terminals that can read cards with chips, then the responsbility – “liability” — for that fraudulent transaction is passed – “shifted” — to you, not the bank.

In other words, if a merchant chooses not to use chip card readers, the merchant — not the bank – will be held responsible for the loss.

According to Visa's “U.S. Merchant EMV Chip Acceptance Readiness Guide”:

“The liability shift only is for counterfeit cards and does not pertain to lost and stolen cards. The party that is the cause of a chip transaction not being conducted (i.e., either the issuer or the merchant’s acquirer or acquirer processor) will be held financially liable for any resulting card-present counterfeit fraud losses.”

Two things to note:

1. Only “customer-present, card-present” transactions, in which a customer uses a card in your store, are subject to the liability shift. Customer-not-present transactions, such as Mail Orders, Telephone Orders, and online orders, are subject to the current terms of your processing agreement. WordStock enables you to classify individual card transactions as mail/telephone/online order on a per-transaction basis.

2. If a customer pays with a fraudulent magnetic-stripe-only card, i.e., a card without a chip, and the transaction is authorized, the bank, not the store, is responsible for the “chargeback.”

NB: In the PCI world, a “chargeback” is not like a book industry chargeback — it occurs when a customer successfully disputes a card payment transaction’s validity. If you choose to not to install chip-reading, EMV-compliant terminals, you should monitor the chargebacks section of your monthly bank statement(s) for unusual activity.

 

How do I found out what my store’s chargeback history is?

Your monthly report from Bank of America Merchant Services details chargebacks in a section labeled “CHGBK/REJECT/ADJ SUMMARY.” You may wish to use that information for evaluating your potential liability based on past experience.

 

What is WordStock's current overall direction with respect to upcoming industry-wide changes in credit and debit card processing?

After investigating the alternatives, we’ve concluded that the best solution to the liability shift coming later this year, with respect to EMV and PCI compliance, is the Verifone Point product.


What is 'Point'?

In its most comprehensive form, Point is a Verifone PIN pad that runs Verifone “middleware” software and handles card swiping, EMV input, PIN entry, and tranasction authorization for a monthly subscription fee.


Which Verifone PIN pad will be used?

Initially, the MX925. It is possible that other Verifone Point-capable PIN-pads may be used in the future, but for now we’re focusing on the MX925, which is certified PCI compliant until April 30 2020.

Verifone MX925

Why the MX925?

The unit handles all known requirements, PIN, EMV, PCI at a reasonable price point.


What will Point cost?

Each WordStock POS register will require a Verifone MX925 running Point; monthly costs are:

MX 925 Base unit, per POS $35.00

Options we recommend:

Priority Exchange 1.50
PCI/SAQ 2.50
Low contour stand 2.00
---------------------------------------------------
TOTAL, per POS, w/options $41.00

The total will be billed monthly by Verifone directly to booksellers.


Can I buy a Verifone MX925 outright, instead of paying a monthly rental fee?

Yes, MX925s are sold by many vendors; our research suggests that current selling prices range from $613 to $700, each.

If you buy your own unit, you will have to send it to Verifone so they can load Point software on it. Verifone charges $20, per unit, for this service. In addition, you'll have to pay roundtrip shipping costs.

• You will also need to enter into a Service Only agreement with Verifone, not WordStock, which costs $19/month, per device.

The downside of buying your own MX925 is that you will be responsible for any maintenance, repair, or replacement costs. In addition, should the Point software need to be reloaded for any reason, such as it having been compromised because the MX925 needed repair, you'll need to send the unit to Verifone for Point software loading, as described above.

A further consideration to bear in mind is that Payment Card Industry requirements may change in such a way that the MX925 becomes obsolete, in which case you would need to purchase successor units. (Note that Verifone claims the MX925 will be compliant for at least 3 years.)

Conversely, if you use the rental package that we recommend, including the Priority Exchange option, obsolete units would be replaced with then-current units at no additional cost.


What are the POS location requirements?

1. One Point PIN-pad/software combo for each WordStock POS register;

2. Each PIN-pad connects via Ethernet, so there will need to be an Ethernet jack and/or a network switch at POS.


Will I still need a dedicated modem/phone line for processing credit cards?

No, because the Verifone Point solution includes the capability of storing transactions if the communication connection breaks and transmitting them when the connection is restored.

As Verifone states:

“When this Store and Forward [SAF] configuration parameter is enabled and there is loss of connectivity to the server, the payment acceptance device can locally approve transactions below a set floor limit until such time as a total limit is reached.”


How will Point work with WordStock's POS software?

After totaling a sale at a WordStock POS register, if the customer wants to pay with a credit or debit card WordStock's software will send a message to Point containing summary information such as Total, Tax, etc. Then, control is transfered to the Verifone products which will handle acquisition of the card data, PIN, amount approval, and then initiate a real-time authorization, the results of which are relayed back to the WordStock register.


What are the merits of this approach?

The Verifone PIN pads and Point software are already certified as PCI compliant and capable of obtaining authorizations. Should either fall out of compliance, Verifone will replace/update as required. This solves the PCI security issue and ensures a compliant platform into the future.


When will the Point-Wordstock products be available?

Mid-September 2015, assuming Verifone certifies the interface within the next 90 days, which seems doable at this time. Updates on availability will be posted here as events unfold.


Will EMV be supported?

The MX925 is EMV capable, so EMV will be supported once the certification process is complete. We are working to obtain certification for WordStock's use of EMV via Point according to the industry timelines for implementation later this year. Because other parties are involved with that process, we can't be certain at this point when this will be completed.

 

How do I complete the “Information for Estate Management Customer ID” in the Point Client Survery document?

There are two areas of the Point Client Survey that you need to complete:

• The “Company Information’ section at the top of page 1;

• At the bottom of page 2, in the “Information for Estate Management Customer ID” section, you need to enter your “Login Name.”

NB: “WordStock CCA Help,” along with our phone number and email address, should already be entered as the “Key Contact” for Point/Verifone/EMV issues.

Your “Login Name”, will be your WordStock Customer ID; to get your Customer ID, please email John McDowell, WordStock Support, or call 800-444-7224, opt 1.


What is ‘Priority Exchange’?

A replacement terminal can be expedited to the merchant location prior to Verifone receiving the device which it is intended to replace. Priority Exchange Services are only available to merchants in the United States.


What is ‘PCI/SAQ’?

PCI/SAQ Tool is a support service, provided by a third party company, ControlScan, to help merchants complete the required 'Payment Card Industry Self-Assessment Questionnaire,' abbreviated as 'PCI/SAQ.' (The SAQ is used to confirm that your store’s systems and procedures comply with the latest credit card security requirements.)

PCI/SAQ Tool includes services and resources, such as a step-by-step online questionnaire, scanning of your POS system, and guidance for establishing compliant in-store policies, to help merchants establish their compliance with security requirements.


What is a 'Low Contour Stand'?

The SQR Low Contour Stand is a device for holding the Verifone MX925 securely at the POS:

• Mounts and protects the Verifone MX925;
• Tilts up 0-90° for easy viewing; helps meet ADA requirements and prevents screen glare;
• Rotates 180° for customer to associate viewing;
• Security magnet;
• Low profile design hides underneath the device;
• Machined standoffs fit the device perfectly;
• Field adjustable tilt and swivel tension;
• Glue pad system available;
• Integrated cable management.

 

Click for a printer-friendly 'PDF' of this page

 

EMV / Chip & PIN / Credit & Debit Card Processing Overview

After considering the needs of our customers and studying possible alternatives, we have selected Point, an integrated hardware/software solution provided by Verifone. While there are still many details to be resolved, things will work along these lines:

• A Verifone card reader running Point software will be installed at each WordStock POS register.

• When a customer pays with a debit or credit card, WordStock will transfer control of the payment transaction to the Verifone device; all further interaction with the customer with respect to payment via a card will be on the Verifone device. This includes prompting the customer to "insert the card", "enter PIN", etc., as well as eventually obtaining a real-time authorization.

• Only the result of the authorization request will be relayed back to WordStock, at which point the sale can be concluded.

Note that not all Verifone devices can run the Point software; however, Point does run on a variety of Verifone hardware that spans a broad range of capability at comparable cost.


Verifone / Point Highlights

• EMV (Chip & PIN) capable;

• NFC (Apple and Google) capable;

• Every transaction is encrypted and guaranteed to be secure. Since no card data will be stored on the WordStock computer, PCI compliance at the computer system level is assured.

Charges for Verfone's Point package will be per-month per-device and can optionally include priority replacement service. Point software updates are included in the monthly fee.

Verifone Rental Documents

NEW Completing Verifone Documents for Point Service

There are 3 electronic documents you need to complete to sign up for Point service with Verifone, including EMV and chip-and-PIN; links for these documents are below; each document will open in a separate, popup window:

Point Service Agreement with MX925 Rental [pdf]

OR

Point Service Agreement - Service Only [pdf]

ACH Authorization [pdf]

Point Client Survey [MS Word]


When you've completed the forms:

Please email them to Christina Beard at Verifone who is working with WordStock customers:
Christina.beard@verifone.com

Also, please email Norm Gosselin when you've submitted the forms so that we can monitor your application's progress; thank you.

If you have questions about completing the forms, please email John McDowell, WordStock Support, or call 800-444-7224, opt 1.

Verifone MX925 Specifications

The Verifone MX 925 has a 7" high-resolution WVGA color display which accommodates optional signature capture along with scrolling account activity;

• NFC/contactless enabled to support electronic wallets;

Processor:
400 MHz ARM11 32-bit RISC processor;

Memory:
512MB (256MB Flash, 256MB SDRAM)

Display:
- 7" WVGA (800 x 480);
- capacitive touch screen;
- Corning® Gorilla® Glass technology;

Connectivity:
Connect I/O with Ethernet 10/100 BaseT;

Card Readers:
- Triple track bi-directional MSR | landed smart card;
- EMVCo L1 and L2 certification;
- Supports major NFC/ contactless schemes;

Security PCI PTS 4.0 approved

Power pack output requirements: 12W, 12-24VDC,

Power Pack input requirements:
100-240VAC, 50/60Hz

Physical:
2.2" H x 8.6" W x 9.1" D;
weight 2.0lbs